refactor: consolidate sandbox management and initialization

- Moved sandbox-related classes and functions into a dedicated module for better organization. - Updated the sandbox initialization process to streamline asset management and environment setup. - Removed deprecated constants and refactored related code to utilize new sandbox entities. - Enhanced the workflow context to support sandbox integration, allowing for improved state management during execution. - Adjusted various components to utilize the new sandbox structure, ensuring compatibility across the application.
2026-05-04 01:18:05 +08:00 · 2026-01-21 20:42:19 +08:00
parent 1fcff5f8d1
commit 9ed83a808a
30 changed files with 449 additions and 545 deletions
--- a/api/core/app/apps/advanced_chat/app_generator.py
+++ b/api/core/app/apps/advanced_chat/app_generator.py
@ -30,6 +30,7 @@ from core.model_runtime.errors.invoke import InvokeAuthorizationError
 from core.ops.ops_trace_manager import TraceQueueManager
 from core.prompt.utils.get_thread_messages_length import get_thread_messages_length
 from core.repositories import DifyCoreRepositoryFactory
+from core.sandbox import Sandbox, SandboxManager
 from core.workflow.repositories.draft_variable_repository import (
    DraftVariableSaverFactory,
 )
@ -43,6 +44,7 @@ from models import Account, App, Conversation, EndUser, Message, Workflow, Workf
 from models.enums import WorkflowRunTriggeredFrom
 from models.workflow_features import WorkflowFeatures
 from services.conversation_service import ConversationService
+from services.sandbox.sandbox_provider_service import SandboxProviderService
 from services.workflow_draft_variable_service import (
    DraftVarLoader,
    WorkflowDraftVariableService,
@ -514,19 +516,30 @@ class AdvancedChatAppGenerator(MessageBasedAppGenerator):
                if workflow is None:
                    raise ValueError("Workflow not found")

+                sandbox: Sandbox | None = None
                graph_engine_layers: tuple = ()
                if workflow.get_feature(WorkflowFeatures.SANDBOX).enabled:
-                    if application_generate_entity.workflow_run_id is None:
-                        raise ValueError("workflow_run_id is required when sandbox is enabled")
-                    graph_engine_layers = (
-                        SandboxLayer(
+                    sandbox_provider = SandboxProviderService.get_sandbox_provider(
+                        application_generate_entity.app_config.tenant_id
+                    )
+                    if workflow.version == Workflow.VERSION_DRAFT:
+                        sandbox = SandboxManager.create_draft(
+                            tenant_id=application_generate_entity.app_config.tenant_id,
+                            app_id=application_generate_entity.app_config.app_id,
+                            user_id=application_generate_entity.user_id,
+                            sandbox_provider=sandbox_provider,
+                        )
+                    else:
+                        if application_generate_entity.workflow_run_id is None:
+                            raise ValueError("workflow_run_id is required when sandbox is enabled")
+                        sandbox = SandboxManager.create(
                            tenant_id=application_generate_entity.app_config.tenant_id,
                            app_id=application_generate_entity.app_config.app_id,
                            user_id=application_generate_entity.user_id,
-                            workflow_version=workflow.version,
                            workflow_execution_id=application_generate_entity.workflow_run_id,
-                        ),
-                    )
+                            sandbox_provider=sandbox_provider,
+                        )
+                    graph_engine_layers = (SandboxLayer(sandbox=sandbox),)

                # Determine system_user_id based on invocation source
                is_external_api_call = application_generate_entity.invoke_from in {
@ -559,6 +572,7 @@ class AdvancedChatAppGenerator(MessageBasedAppGenerator):
                workflow_execution_repository=workflow_execution_repository,
                workflow_node_execution_repository=workflow_node_execution_repository,
                graph_engine_layers=graph_engine_layers,
+                sandbox=sandbox,
            )

            try:
--- a/api/core/app/apps/advanced_chat/app_runner.py
+++ b/api/core/app/apps/advanced_chat/app_runner.py
@ -24,6 +24,7 @@ from core.app.layers.conversation_variable_persist_layer import ConversationVari
 from core.db.session_factory import session_factory
 from core.moderation.base import ModerationError
 from core.moderation.input_moderation import InputModeration
+from core.sandbox import Sandbox
 from core.variables.variables import Variable
 from core.workflow.enums import WorkflowType
 from core.workflow.graph_engine.command_channels.redis_channel import RedisChannel
@ -66,6 +67,7 @@ class AdvancedChatAppRunner(WorkflowBasedAppRunner):
        workflow_execution_repository: WorkflowExecutionRepository,
        workflow_node_execution_repository: WorkflowNodeExecutionRepository,
        graph_engine_layers: Sequence[GraphEngineLayer] = (),
+        sandbox: Sandbox | None = None,
    ):
        super().__init__(
            queue_manager=queue_manager,
@ -82,6 +84,7 @@ class AdvancedChatAppRunner(WorkflowBasedAppRunner):
        self._app = app
        self._workflow_execution_repository = workflow_execution_repository
        self._workflow_node_execution_repository = workflow_node_execution_repository
+        self._sandbox = sandbox

    @trace_span(WorkflowAppRunnerHandler)
    def run(self):
@ -156,6 +159,10 @@ class AdvancedChatAppRunner(WorkflowBasedAppRunner):

            # init graph
            graph_runtime_state = GraphRuntimeState(variable_pool=variable_pool, start_at=time.time())
+
+            if self._sandbox:
+                graph_runtime_state.set_sandbox(self._sandbox)
+
            graph = self._init_graph(
                graph_config=self._workflow.graph_dict,
                graph_runtime_state=graph_runtime_state,
--- a/api/core/app/apps/workflow/app_generator.py
+++ b/api/core/app/apps/workflow/app_generator.py
@ -29,6 +29,7 @@ from core.helper.trace_id_helper import extract_external_trace_id_from_args
 from core.model_runtime.errors.invoke import InvokeAuthorizationError
 from core.ops.ops_trace_manager import TraceQueueManager
 from core.repositories import DifyCoreRepositoryFactory
+from core.sandbox import Sandbox, SandboxManager
 from core.workflow.graph_engine.layers.base import GraphEngineLayer
 from core.workflow.repositories.draft_variable_repository import DraftVariableSaverFactory
 from core.workflow.repositories.workflow_execution_repository import WorkflowExecutionRepository
@ -40,6 +41,7 @@ from libs.flask_utils import preserve_flask_contexts
 from models import Account, App, EndUser, Workflow, WorkflowNodeExecutionTriggeredFrom
 from models.enums import WorkflowRunTriggeredFrom
 from models.workflow_features import WorkflowFeatures
+from services.sandbox.sandbox_provider_service import SandboxProviderService
 from services.workflow_draft_variable_service import DraftVarLoader, WorkflowDraftVariableService

 SKIP_PREPARE_USER_INPUTS_KEY = "_skip_prepare_user_inputs"
@ -490,16 +492,29 @@ class WorkflowAppGenerator(BaseAppGenerator):
                if workflow is None:
                    raise ValueError("Workflow not found")

+                sandbox: Sandbox | None = None
                if workflow.get_feature(WorkflowFeatures.SANDBOX).enabled:
-                    graph_engine_layers = (
-                        *graph_engine_layers,
-                        SandboxLayer(
+                    sandbox_provider = SandboxProviderService.get_sandbox_provider(
+                        application_generate_entity.app_config.tenant_id
+                    )
+                    if workflow.version == Workflow.VERSION_DRAFT:
+                        sandbox = SandboxManager.create_draft(
+                            tenant_id=application_generate_entity.app_config.tenant_id,
+                            app_id=application_generate_entity.app_config.app_id,
+                            user_id=application_generate_entity.user_id,
+                            sandbox_provider=sandbox_provider,
+                        )
+                    else:
+                        sandbox = SandboxManager.create(
                            tenant_id=application_generate_entity.app_config.tenant_id,
                            app_id=application_generate_entity.app_config.app_id,
                            user_id=application_generate_entity.user_id,
-                            workflow_version=workflow.version,
                            workflow_execution_id=application_generate_entity.workflow_execution_id,
-                        ),
+                            sandbox_provider=sandbox_provider,
+                        )
+                    graph_engine_layers = (
+                        *graph_engine_layers,
+                        SandboxLayer(sandbox=sandbox),
                    )

                # Determine system_user_id based on invocation source
@ -526,6 +541,7 @@ class WorkflowAppGenerator(BaseAppGenerator):
                workflow_node_execution_repository=workflow_node_execution_repository,
                root_node_id=root_node_id,
                graph_engine_layers=graph_engine_layers,
+                sandbox=sandbox,
            )

            try:
--- a/api/core/app/apps/workflow/app_runner.py
+++ b/api/core/app/apps/workflow/app_runner.py
@ -7,6 +7,7 @@ from core.app.apps.base_app_queue_manager import AppQueueManager
 from core.app.apps.workflow.app_config_manager import WorkflowAppConfig
 from core.app.apps.workflow_app_runner import WorkflowBasedAppRunner
 from core.app.entities.app_invoke_entities import InvokeFrom, WorkflowAppGenerateEntity
+from core.sandbox import Sandbox
 from core.workflow.enums import WorkflowType
 from core.workflow.graph_engine.command_channels.redis_channel import RedisChannel
 from core.workflow.graph_engine.layers.base import GraphEngineLayer
@ -42,6 +43,7 @@ class WorkflowAppRunner(WorkflowBasedAppRunner):
        workflow_execution_repository: WorkflowExecutionRepository,
        workflow_node_execution_repository: WorkflowNodeExecutionRepository,
        graph_engine_layers: Sequence[GraphEngineLayer] = (),
+        sandbox: Sandbox | None = None,
    ):
        super().__init__(
            queue_manager=queue_manager,
@ -55,6 +57,7 @@ class WorkflowAppRunner(WorkflowBasedAppRunner):
        self._root_node_id = root_node_id
        self._workflow_execution_repository = workflow_execution_repository
        self._workflow_node_execution_repository = workflow_node_execution_repository
+        self._sandbox = sandbox

    @trace_span(WorkflowAppRunnerHandler)
    def run(self):
@ -99,6 +102,9 @@ class WorkflowAppRunner(WorkflowBasedAppRunner):

            graph_runtime_state = GraphRuntimeState(variable_pool=variable_pool, start_at=time.perf_counter())

+            if self._sandbox:
+                graph_runtime_state.set_sandbox(self._sandbox)
+
            # init graph
            graph = self._init_graph(
                graph_config=self._workflow.graph_dict,