Merge main HEAD (segment 5) into sandboxed-agent-rebase

Resolve 83 conflicts: 10 backend, 62 frontend, 11 config/lock files.
Preserve sandbox/agent/collaboration features while adopting main's
UI refactorings (Dialog/AlertDialog/Popover), model provider updates,
and enterprise features.

Made-with: Cursor

api/extensions/ext_fastopenapi.py

@@ -1,3 +1,5 @@
+from typing import Protocol, cast
+
 from fastopenapi.routers import FlaskRouter
 from flask_cors import CORS
 
@@ -9,6 +11,10 @@ from extensions.ext_blueprints import AUTHENTICATED_HEADERS, EXPOSED_HEADERS
 DOCS_PREFIX = "/fastopenapi"
 
 
+class SupportsIncludeRouter(Protocol):
+    def include_router(self, router: object, *, prefix: str = "") -> None: ...
+
+
 def init_app(app: DifyApp) -> None:
     docs_enabled = dify_config.SWAGGER_UI_ENABLED
     docs_url = f"{DOCS_PREFIX}/docs" if docs_enabled else None
@@ -36,7 +42,7 @@ def init_app(app: DifyApp) -> None:
     _ = remote_files
     _ = setup
 
-    router.include_router(console_router, prefix="/console/api")
+    cast(SupportsIncludeRouter, router).include_router(console_router, prefix="/console/api")
     CORS(
         app,
         resources={r"/console/api/.*": {"origins": dify_config.CONSOLE_CORS_ALLOW_ORIGINS}},

api/extensions/ext_login.py

@@ -3,6 +3,7 @@ import json
 import flask_login
 from flask import Response, request
 from flask_login import user_loaded_from_request, user_logged_in
+from sqlalchemy import select
 from werkzeug.exceptions import NotFound, Unauthorized
 
 from configs import dify_config
@@ -34,16 +35,15 @@ def load_user_from_request(request_from_flask_login):
         if admin_api_key and admin_api_key == auth_token:
             workspace_id = request.headers.get("X-WORKSPACE-ID")
             if workspace_id:
-                tenant_account_join = (
-                    db.session.query(Tenant, TenantAccountJoin)
+                tenant_account_join = db.session.execute(
+                    select(Tenant, TenantAccountJoin)
                     .where(Tenant.id == workspace_id)
                     .where(TenantAccountJoin.tenant_id == Tenant.id)
                     .where(TenantAccountJoin.role == "owner")
-                    .one_or_none()
-                )
+                ).one_or_none()
                 if tenant_account_join:
                     tenant, ta = tenant_account_join
-                    account = db.session.query(Account).filter_by(id=ta.account_id).first()
+                    account = db.session.scalar(select(Account).where(Account.id == ta.account_id))
                     if account:
                         account.current_tenant = tenant
                         return account
@@ -70,7 +70,7 @@ def load_user_from_request(request_from_flask_login):
             end_user_id = decoded.get("end_user_id")
             if not end_user_id:
                 raise Unauthorized("Invalid Authorization token.")
-            end_user = db.session.query(EndUser).where(EndUser.id == end_user_id).first()
+            end_user = db.session.scalar(select(EndUser).where(EndUser.id == end_user_id))
             if not end_user:
                 raise NotFound("End user not found.")
             return end_user
@@ -80,7 +80,7 @@ def load_user_from_request(request_from_flask_login):
             decoded = PassportService().verify(auth_token)
             end_user_id = decoded.get("end_user_id")
             if end_user_id:
-                end_user = db.session.query(EndUser).where(EndUser.id == end_user_id).first()
+                end_user = db.session.scalar(select(EndUser).where(EndUser.id == end_user_id))
                 if not end_user:
                     raise NotFound("End user not found.")
                 return end_user
@@ -90,11 +90,11 @@ def load_user_from_request(request_from_flask_login):
         server_code = request.view_args.get("server_code") if request.view_args else None
         if not server_code:
             raise Unauthorized("Invalid Authorization token.")
-        app_mcp_server = db.session.query(AppMCPServer).where(AppMCPServer.server_code == server_code).first()
+        app_mcp_server = db.session.scalar(select(AppMCPServer).where(AppMCPServer.server_code == server_code).limit(1))
         if not app_mcp_server:
             raise NotFound("App MCP server not found.")
-        end_user = (
-            db.session.query(EndUser).where(EndUser.session_id == app_mcp_server.id, EndUser.type == "mcp").first()
+        end_user = db.session.scalar(
+            select(EndUser).where(EndUser.session_id == app_mcp_server.id, EndUser.type == "mcp").limit(1)
         )
         if not end_user:
             raise NotFound("End user not found.")

api/extensions/otel/runtime.py

@@ -5,7 +5,7 @@ from typing import Union
 
 from celery.signals import worker_init
 from flask_login import user_loaded_from_request, user_logged_in
-from opentelemetry import trace
+from opentelemetry import metrics, trace
 from opentelemetry.propagate import set_global_textmap
 from opentelemetry.propagators.b3 import B3MultiFormat
 from opentelemetry.propagators.composite import CompositePropagator
@@ -31,9 +31,29 @@ def setup_context_propagation() -> None:
 
 
 def shutdown_tracer() -> None:
+    flush_telemetry()
+
+
+def flush_telemetry() -> None:
+    """
+    Best-effort flush for telemetry providers.
+
+    This is mainly used by short-lived command processes (e.g. Kubernetes CronJob)
+    so counters/histograms are exported before the process exits.
+    """
     provider = trace.get_tracer_provider()
     if hasattr(provider, "force_flush"):
-        provider.force_flush()
+        try:
+            provider.force_flush()
+        except Exception:
+            logger.exception("otel: failed to flush trace provider")
+
+    metric_provider = metrics.get_meter_provider()
+    if hasattr(metric_provider, "force_flush"):
+        try:
+            metric_provider.force_flush()
+        except Exception:
+            logger.exception("otel: failed to flush metric provider")
 
 
 def is_celery_worker():

api/extensions/storage/opendal_storage.py

@@ -32,7 +32,7 @@ class OpenDALStorage(BaseStorage):
         kwargs = kwargs or _get_opendal_kwargs(scheme=scheme)
 
         if scheme == "fs":
-            root = kwargs.get("root", "storage")
+            root = kwargs.setdefault("root", "storage")
             Path(root).mkdir(parents=True, exist_ok=True)
 
         retry_layer = opendal.layers.RetryLayer(max_times=3, factor=2.0, jitter=True)