Skip to content

fix: SSRF bypass via raw httpx.get in API tool schema fetch#37746

Open
Snakinya wants to merge 1 commit into
langgenius:mainfrom
Snakinya:security-fix/GHSA-gfmc-xc6g-q7g2
Open

fix: SSRF bypass via raw httpx.get in API tool schema fetch#37746
Snakinya wants to merge 1 commit into
langgenius:mainfrom
Snakinya:security-fix/GHSA-gfmc-xc6g-q7g2

Conversation

@Snakinya

@Snakinya Snakinya commented Jun 22, 2026

Copy link
Copy Markdown

Summary

Fixes GHSA-gfmc-xc6g-q7g2

The API tool schema fetch endpoint used raw httpx.get() to fetch user-supplied URLs, completely bypassing the Squid SSRF proxy protection that Dify relies on.

Root cause: The code imported from httpx import get instead of using the ssrf_proxy module. httpx.get() reads standard HTTP_PROXY/HTTPS_PROXY env vars, but Dify only sets SSRF_PROXY_HTTP_URL/SSRF_PROXY_HTTPS_URL (custom vars consumed by ssrf_proxy.py). As a result, all URL fetches through this code path connect directly without any proxy.

Impact: Any authenticated user could make the server fetch arbitrary internal URLs (cloud metadata 169.254.169.254, Redis, Postgres, internal APIs), bypassing the SSRF proxy entirely.

Changes

  • api/services/tools/api_tools_manage_service.py: replace from httpx import get + get(url, ...) with from core.helper import ssrf_proxy + ssrf_proxy.get(url, ...)
  • api/core/tools/utils/parser.py: replace import httpx + httpx.get(api_url, ...) with from core.helper import ssrf_proxy + ssrf_proxy.get(api_url, ...)
  • api/tests/unit_tests/core/tools/utils/test_parser.py: update mock path from core.tools.utils.parser.httpx.get to core.tools.utils.parser.ssrf_proxy.get

ssrf_proxy.get() has the same signature as httpx.get() (url, **kwargs -> httpx.Response) and is the standard pattern used across the codebase (e.g., core/tools/custom_tool/tool.py, core/file/remote_fetcher.py).

Test plan

All 23 tests pass:

  • tests/unit_tests/core/tools/utils/test_parser.py (14 tests)
  • tests/unit_tests/tools/test_api_tool.py (9 tests)

security: fix SSRF bypass via raw httpx.get() in API tool schema fetch
828aad7 
GHSA-gfmc-xc6g-q7g2: The API tool schema fetch endpoint used raw
httpx.get() instead of ssrf_proxy.get(), bypassing the Squid SSRF
proxy protection. This allowed authenticated users to make requests
to internal services (cloud metadata, Redis, Postgres, etc.).

Fix: replace httpx.get() with ssrf_proxy.get() in:
- api/services/tools/api_tools_manage_service.py (get_api_tool_provider_remote_schema)
- api/core/tools/utils/parser.py (parse_openai_plugin_json_to_tool_bundle)

Update test mock paths accordingly. All 23 tests pass.
@dosubot dosubot Bot added the size:XS This PR changes 0-9 lines, ignoring generated files. label Jun 22, 2026
@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Pyrefly Diff

base → PR 
--- /tmp/pyrefly_base.txt	2026-06-23 08:45:18.199640294 +0000
+++ /tmp/pyrefly_pr.txt	2026-06-23 08:45:04.475554948 +0000
@@ -2049,57 +2049,31 @@
 ERROR No attribute `MethodView` in module `builtins` [missing-attribute]
  --> tests/unit_tests/controllers/common/test_fields.py:9:5
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.completion._create_chat_message` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1170:74
+   --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:952:74
 ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.completion._create_chat_message` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1170:98
+   --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:952:98
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.completion._create_chat_message` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1207:30
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1002:30
 ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.completion._create_chat_message` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1208:27
-ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.completion._resolve_current_user_agent_debug_conversation_id` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1235:22
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.completion._resolve_current_user_agent_debug_conversation_id` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1236:19
-ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.completion._resolve_current_user_agent_debug_conversation_id` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1241:22
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.completion._resolve_current_user_agent_debug_conversation_id` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1242:19
-ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.completion._create_chat_message` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1293:30
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.completion._create_chat_message` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1294:27
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1003:27
 ERROR Object of class `object` has no attribute `data` [missing-attribute]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1376:50
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1083:50
 ERROR Object of class `object` has no attribute `limit` [missing-attribute]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1377:30
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1084:30
 ERROR Object of class `object` has no attribute `has_more` [missing-attribute]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1378:33
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.message._list_chat_messages` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1390:67
-ERROR Object of class `object` has no attribute `data` [missing-attribute]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1416:50
-ERROR Object of class `object` has no attribute `limit` [missing-attribute]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1417:30
-ERROR Object of class `object` has no attribute `has_more` [missing-attribute]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1418:33
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.message._list_chat_messages` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1432:67
-ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account | None` in function `controllers.console.app.message._list_chat_messages` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1432:91
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1085:33
 ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.message._list_chat_messages` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1452:27
-ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account | None` in function `controllers.console.app.message._list_chat_messages` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1453:30
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1097:67
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.message._update_message_feedback` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1468:30
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1113:30
 ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.message._update_message_feedback` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1469:27
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1114:27
 ERROR Argument `SimpleNamespace` is not assignable to parameter `current_user` with type `Account` in function `controllers.console.app.message._get_message_suggested_questions` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1505:26
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1150:26
 ERROR Argument `SimpleNamespace` is not assignable to parameter `app_model` with type `App` in function `controllers.console.app.message._get_message_suggested_questions` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1506:23
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1151:23
 ERROR Argument `Literal['00000000-0000-0000-0000-000000000002']` is not assignable to parameter `message_id` with type `UUID` in function `controllers.console.app.message._get_message_suggested_questions` [bad-argument-type]
-    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1507:24
+    --> tests/unit_tests/controllers/console/agent/test_agent_controllers.py:1152:24
 ERROR Object of class `int` has no attribute `lower` [missing-attribute]
    --> tests/unit_tests/controllers/console/app/test_annotation_security.py:221:38
 ERROR Object of class `int` has no attribute `lower` [missing-attribute]
@@ -2287,11 +2261,7 @@
 ERROR Argument `list[str]` is not assignable to parameter `fields` with type `set[str] | None` in function `controllers.openapi.apps.build_app_describe_response` [bad-argument-type]
   --> tests/unit_tests/controllers/openapi/test_app_describe_builder.py:72:48
 ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `controllers.openapi.apps.parameters_payload` [bad-argument-type]
-  --> tests/unit_tests/controllers/openapi/test_app_payloads.py:39:28
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `controllers.openapi.apps._is_listable` [bad-argument-type]
-  --> tests/unit_tests/controllers/openapi/test_app_payloads.py:65:25
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `controllers.openapi.apps._is_listable` [bad-argument-type]
-  --> tests/unit_tests/controllers/openapi/test_app_payloads.py:70:25
+  --> tests/unit_tests/controllers/openapi/test_app_payloads.py:37:28
 ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `controllers.openapi.app_run._run_chat` [bad-argument-type]
   --> tests/unit_tests/controllers/openapi/test_app_run_streaming.py:50:13
 ERROR Object of class `UnprocessableEntity` has no attribute `data` [missing-attribute]
@@ -3264,13 +3234,6 @@
 ERROR Object of class `Mapping` has no attribute `model_dump`
 ERROR Object of class `LayerConfig` has no attribute `drive_ref`
 ERROR Object of class `LayerConfig` has no attribute `skills`
-ERROR Object of class `LayerConfig` has no attribute `mentioned_skill_keys`
-ERROR Object of class `LayerConfig` has no attribute `drive_ref`
-ERROR Object of class `LayerConfig` has no attribute `skills`
-ERROR Object of class `LayerConfig` has no attribute `prefix`
-ERROR Object of class `LayerConfig` has no attribute `prefix`
-ERROR Object of class `LayerConfig` has no attribute `prefix`
-ERROR Object of class `LayerConfig` has no attribute `prefix`
 ERROR Object of class `FromClause` has no attribute `create` [missing-attribute]
   --> tests/unit_tests/core/app/apps/agent_app/test_session_store.py:58:5
 ERROR Object of class `FromClause` has no attribute `drop` [missing-attribute]
@@ -3278,11 +3241,11 @@
 ERROR Argument `dict[str, dict[str, str]]` is not assignable to parameter `override_config_dict` with type `AppModelConfigDict | None` in function `core.app.apps.agent_chat.app_config_manager.AgentChatAppConfigManager.get_app_config` [bad-argument-type]
   --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_config_manager.py:41:34
 ERROR Object of class `FunctionType` has no attribute `assert_called_once` [missing-attribute]
-  --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py:59:9
+  --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py:47:9
 ERROR Object of class `FunctionType` has no attribute `assert_called_once` [missing-attribute]
-  --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py:88:9
+  --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py:76:9
 ERROR Object of class `FunctionType` has no attribute `assert_called_once` [missing-attribute]
-   --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py:207:9
+   --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_app_runner.py:198:9
 ERROR Cannot index into `str` [bad-index]
    --> tests/unit_tests/core/app/apps/agent_chat/test_agent_chat_generate_response_converter.py:158:16
 ERROR Cannot index into `str` [bad-index]
@@ -3306,61 +3269,53 @@
 ERROR Argument `dict[str, str]` is not assignable to parameter `override_config_dict` with type `AppModelConfigDict | None` in function `core.app.apps.chat.app_config_manager.ChatAppConfigManager.get_app_config` [bad-argument-type]
   --> tests/unit_tests/core/app/apps/chat/test_app_config_manager.py:37:38
 ERROR No matching overload found for function `core.app.apps.chat.app_generator.ChatAppGenerator.generate` called with arguments: (app_model=SimpleNamespace, user=SimpleNamespace, args=dict[str, dict[@_, @_]], invoke_from=Literal[InvokeFrom.SERVICE_API], streaming=Literal[False]) [no-matching-overload]
-  --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:50:31
+  --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:36:31
 ERROR No matching overload found for function `core.app.apps.chat.app_generator.ChatAppGenerator.generate` called with arguments: (app_model=SimpleNamespace, user=SimpleNamespace, args=dict[str, dict[@_, @_] | int], invoke_from=Literal[InvokeFrom.SERVICE_API], streaming=Literal[False]) [no-matching-overload]
-  --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:61:31
+  --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:47:31
 ERROR No matching overload found for function `core.app.apps.chat.app_generator.ChatAppGenerator.generate` called with arguments: (SimpleNamespace, SimpleNamespace, dict[str, dict[Unknown, Unknown] | str | dict[str, str]], Literal[InvokeFrom.DEBUGGER], streaming=Literal[False]) [no-matching-overload]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:108:40
+  --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:94:40
 ERROR No matching overload found for function `core.app.apps.chat.app_generator.ChatAppGenerator.generate` called with arguments: (app_model=SimpleNamespace, user=SimpleNamespace, args=dict[str, dict[@_, @_] | str | dict[str, str]], invoke_from=Literal[InvokeFrom.SERVICE_API], streaming=Literal[False]) [no-matching-overload]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:121:35
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:107:35
 ERROR Argument `DummyGenerateEntity` is not assignable to parameter `application_generate_entity` with type `ChatAppGenerateEntity` in function `core.app.apps.chat.app_generator.ChatAppGenerator._generate_worker` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:142:45
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:128:45
 ERROR Argument `DummyQueueManager` is not assignable to parameter `queue_manager` with type `AppQueueManager` in function `core.app.apps.chat.app_generator.ChatAppGenerator._generate_worker` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:143:31
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:129:31
 ERROR Argument `DummyGenerateEntity` is not assignable to parameter `application_generate_entity` with type `ChatAppGenerateEntity` in function `core.app.apps.chat.app_generator.ChatAppGenerator._generate_worker` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:158:45
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:144:45
 ERROR Argument `DummyQueueManager` is not assignable to parameter `queue_manager` with type `AppQueueManager` in function `core.app.apps.chat.app_generator.ChatAppGenerator._generate_worker` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:159:31
-ERROR Argument `DummyGenerateEntity` is not assignable to parameter `application_generate_entity` with type `ChatAppGenerateEntity` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:186:28
-ERROR Argument `DummyQueueManager` is not assignable to parameter `queue_manager` with type `AppQueueManager` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:186:49
-ERROR Argument `SimpleNamespace` is not assignable to parameter `conversation` with type `Conversation` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:186:70
-ERROR Argument `SimpleNamespace` is not assignable to parameter `message` with type `Message` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:186:89
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:145:31
 ERROR Argument `DummyGenerateEntity` is not assignable to parameter `application_generate_entity` with type `ChatAppGenerateEntity` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:217:24
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:172:28
 ERROR Argument `DummyQueueManager` is not assignable to parameter `queue_manager` with type `AppQueueManager` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:217:45
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:172:49
 ERROR Argument `SimpleNamespace` is not assignable to parameter `conversation` with type `Conversation` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:217:66
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:172:70
 ERROR Argument `SimpleNamespace` is not assignable to parameter `message` with type `Message` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:217:85
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:172:89
 ERROR Argument `DummyGenerateEntity` is not assignable to parameter `application_generate_entity` with type `ChatAppGenerateEntity` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:254:24
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:206:24
 ERROR Argument `DummyQueueManager` is not assignable to parameter `queue_manager` with type `AppQueueManager` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:254:45
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:206:45
 ERROR Argument `SimpleNamespace` is not assignable to parameter `conversation` with type `Conversation` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:254:60
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:206:66
 ERROR Argument `SimpleNamespace` is not assignable to parameter `message` with type `Message` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:254:79
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:206:85
 ERROR Argument `DummyGenerateEntity` is not assignable to parameter `application_generate_entity` with type `ChatAppGenerateEntity` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:289:24
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:246:24
 ERROR Argument `DummyQueueManager` is not assignable to parameter `queue_manager` with type `AppQueueManager` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:289:45
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:246:45
 ERROR Argument `SimpleNamespace` is not assignable to parameter `conversation` with type `Conversation` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:289:66
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:246:60
 ERROR Argument `SimpleNamespace` is not assignable to parameter `message` with type `Message` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:289:85
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:246:79
 ERROR Argument `DummyGenerateEntity` is not assignable to parameter `application_generate_entity` with type `ChatAppGenerateEntity` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:342:24
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:284:24
 ERROR Argument `DummyQueueManager` is not assignable to parameter `queue_manager` with type `AppQueueManager` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:342:45
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:284:45
 ERROR Argument `SimpleNamespace` is not assignable to parameter `conversation` with type `Conversation` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:342:60
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:284:66
 ERROR Argument `SimpleNamespace` is not assignable to parameter `message` with type `Message` in function `core.app.apps.chat.app_runner.ChatAppRunner.run` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:342:79
+   --> tests/unit_tests/core/app/apps/chat/test_app_generator_and_runner.py:284:85
 ERROR Cannot index into `str` [bad-index]
   --> tests/unit_tests/core/app/apps/chat/test_generate_response_converter.py:60:16
 ERROR Cannot index into `str` [bad-index]
@@ -3422,15 +3377,15 @@
 ERROR Class `PipelineRunner` has no class attribute `call_args` [missing-attribute]
    --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_generator.py:389:12
 ERROR Argument `SimpleNamespace` is not assignable to parameter `application_generate_entity` with type `RagPipelineGenerateEntity` in function `core.app.apps.pipeline.pipeline_runner.PipelineRunner.__init__` [bad-argument-type]
-  --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:92:37
+  --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:66:37
 ERROR Argument `SimpleNamespace` is not assignable to parameter `application_generate_entity` with type `RagPipelineGenerateEntity` in function `core.app.apps.pipeline.pipeline_runner.PipelineRunner.__init__` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:171:37
+   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:141:37
 ERROR Argument `SimpleNamespace` is not assignable to parameter `application_generate_entity` with type `RagPipelineGenerateEntity` in function `core.app.apps.pipeline.pipeline_runner.PipelineRunner.__init__` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:194:37
+   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:164:37
 ERROR Argument `SimpleNamespace` is not assignable to parameter `application_generate_entity` with type `RagPipelineGenerateEntity` in function `core.app.apps.pipeline.pipeline_runner.PipelineRunner.__init__` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:220:37
+   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:190:37
 ERROR Argument `SimpleNamespace` is not assignable to parameter `application_generate_entity` with type `RagPipelineGenerateEntity` in function `core.app.apps.pipeline.pipeline_runner.PipelineRunner.__init__` [bad-argument-type]
-   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:280:37
+   --> tests/unit_tests/core/app/apps/pipeline/test_pipeline_runner.py:249:37
 ERROR `Literal['generated-conversation-id']` is not assignable to attribute `id` with type `Never` [bad-assignment]
   --> tests/unit_tests/core/app/apps/test_advanced_chat_app_generator.py:55:22
 ERROR `Literal['generated-message-id']` is not assignable to attribute `id` with type `Never` [bad-assignment]
@@ -3828,6 +3783,8 @@
    --> tests/unit_tests/core/app/apps/workflow/test_app_generator_extra.py:505:43
 ERROR Argument `SimpleNamespace` is not assignable to parameter `workflow_node_execution_repository` with type `WorkflowNodeExecutionRepository` in function `core.app.apps.workflow.app_generator.WorkflowAppGenerator._generate_worker` [bad-argument-type]
    --> tests/unit_tests/core/app/apps/workflow/test_app_generator_extra.py:506:48
+ERROR `() -> Literal[True]` is not assignable to attribute `_is_stopped` with type `_cachedmethod_wrapper_info[bool]` [bad-assignment]
+  --> tests/unit_tests/core/app/apps/workflow/test_app_queue_manager.py:20:31
 ERROR `in` is not supported between `Literal['blocking response mode']` and `None` [not-iterable]
  --> tests/unit_tests/core/app/apps/workflow/test_errors.py:9:16
 ERROR Cannot index into `str` [bad-index]
@@ -4551,16 +4508,6 @@
    --> tests/unit_tests/core/plugin/impl/test_trigger_client.py:179:21
 ERROR Argument `werkzeug.wrappers.request.Request` is not assignable to parameter `request` with type `flask.wrappers.Request` in function `core.plugin.impl.trigger.PluginTriggerClient.dispatch_event` [bad-argument-type]
    --> tests/unit_tests/core/plugin/impl/test_trigger_client.py:193:25
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `core.plugin.backwards_invocation.app.PluginAppBackwardsInvocation._get_user` [bad-argument-type]
-   --> tests/unit_tests/core/plugin/test_backwards_invocation_app.py:339:62
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `core.plugin.backwards_invocation.app.PluginAppBackwardsInvocation._get_user` [bad-argument-type]
-   --> tests/unit_tests/core/plugin/test_backwards_invocation_app.py:353:62
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `core.plugin.backwards_invocation.app.PluginAppBackwardsInvocation._get_user` [bad-argument-type]
-   --> tests/unit_tests/core/plugin/test_backwards_invocation_app.py:368:59
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `core.plugin.backwards_invocation.app.PluginAppBackwardsInvocation._get_workflow` [bad-argument-type]
-   --> tests/unit_tests/core/plugin/test_backwards_invocation_app.py:393:59
-ERROR Argument `SimpleNamespace` is not assignable to parameter `app` with type `App` in function `core.plugin.backwards_invocation.app.PluginAppBackwardsInvocation._get_app_model_config_dict` [bad-argument-type]
-   --> tests/unit_tests/core/plugin/test_backwards_invocation_app.py:417:74
 ERROR Argument `SimpleNamespace` is not assignable to parameter `tenant` with type `Tenant` in function `core.plugin.backwards_invocation.model.PluginModelBackwardsInvocation.invoke_summary` [bad-argument-type]
   --> tests/unit_tests/core/plugin/test_backwards_invocation_model.py:54:72
 ERROR Generator function should return `Generator` [bad-return]
@@ -5792,8 +5739,6 @@
    --> tests/unit_tests/core/workflow/nodes/agent_v2/test_plugin_tools_builder.py:229:12
 ERROR `not in` is not supported between `Literal['region']` and `None` [not-iterable]
    --> tests/unit_tests/core/workflow/nodes/agent_v2/test_plugin_tools_builder.py:229:12
-ERROR Object of class `LayerConfig` has no attribute `prefix`
-ERROR Object of class `LayerConfig` has no attribute `prefix`
 ERROR Class member `_WaitableFakeAgentBackendRunClient.wait_run` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
    --> tests/unit_tests/core/workflow/nodes/agent_v2/test_session_cleanup_layer.py:113:9
 ERROR Argument `object` is not assignable to parameter `status` with type `Literal['cancelled', 'failed', 'running', 'succeeded']` in function `dify_agent.protocol.schemas.RunStatusResponse.__init__` [bad-argument-type]
@@ -6287,47 +6232,53 @@
 ERROR `<=` is not supported between `None` and `datetime` [unsupported-operation]
    --> tests/unit_tests/libs/_human_input/test_models.py:121:16
 ERROR Object of class `Subscription` has no attribute `_start_if_needed` [missing-attribute]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:155:17
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:158:17
 ERROR Object of class `Subscription` has no attribute `_start_if_needed` [missing-attribute]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:223:17
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:226:17
 ERROR Argument `FakeRedisClient` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis._subscription.RedisSubscriptionBase.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:702:20
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:699:20
 ERROR Argument `FakeRedisClient` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis._subscription.RedisSubscriptionBase.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:722:20
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:719:20
 ERROR Argument `TestRedisShardedSubscription.test_get_message_uses_target_node_for_cluster_client.DummyRedisCluster` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis._subscription.RedisSubscriptionBase.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:907:20
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:905:20
 ERROR Argument `FakeRedisClient` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis._subscription.RedisSubscriptionBase.__init__` [bad-argument-type]
-    --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:1037:20
+    --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:1035:20
 ERROR Argument `FakeRedisClient` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis._subscription.RedisSubscriptionBase.__init__` [bad-argument-type]
-    --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:1134:24
+    --> tests/unit_tests/libs/broadcast_channel/redis/test_channel_unit_tests.py:1133:24
 ERROR Class member `FailExpireRedis.expire` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:75:9
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:147:36
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:130:36
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:175:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:158:45
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:183:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:166:45
+ERROR Argument `FakeStreamsRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:180:43
+ERROR Object of class `Subscription` has no attribute `_join_timeout_ms` [missing-attribute]
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:187:20
+ERROR Argument `FakeStreamsRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:192:43
+ERROR Argument `FakeStreamsRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:205:43
 ERROR Argument `FailExpireRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:197:43
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:222:43
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:248:43
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:273:43
 ERROR Argument `TestStreamsSubscription.test_listener_normalizes_supported_payloads_and_ignores_unsupported_shapes.OneShotRedis` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel._StreamsSubscription.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:273:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:298:45
 ERROR Argument `object` is not assignable to parameter `o` with type `Buffer | Iterable[SupportsIndex] | SupportsBytes | SupportsIndex` in function `bytes.__new__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:281:35
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:306:35
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel._StreamsSubscription.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:322:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:347:45
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel._StreamsSubscription.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:330:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:355:45
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel._StreamsSubscription.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:339:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:364:45
 ERROR Argument `FakeStreamsRedis` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel._StreamsSubscription.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:347:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:372:45
 ERROR Argument `BlockingRedis` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel._StreamsSubscription.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:367:45
-ERROR Argument `FakeStreamsRedis` is not assignable to parameter `client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel._StreamsSubscription.__init__` [bad-argument-type]
-   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:385:45
+   --> tests/unit_tests/libs/broadcast_channel/redis/test_streams_channel_unit_tests.py:399:45
 ERROR Class member `TestCronCompatibility.setUp` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
   --> tests/unit_tests/libs/test_cron_compatibility.py:21:9
 ERROR Class member `TestTimezoneCompatibility.setUp` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
@@ -6382,20 +6333,12 @@
   --> tests/unit_tests/libs/test_time_parser.py:54:38
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account | None` in function `libs.helper.TokenManager.generate_token` [bad-argument-type]
   --> tests/unit_tests/libs/test_token_manager.py:76:17
-ERROR Object of class `object` has no attribute `op` [missing-attribute]
-  --> tests/unit_tests/migrations/test_agent_drive_skill_metadata_refactor.py:59:23
-ERROR Object of class `object` has no attribute `op` [missing-attribute]
-  --> tests/unit_tests/migrations/test_agent_drive_skill_metadata_refactor.py:60:9
-ERROR Object of class `object` has no attribute `op` [missing-attribute]
-  --> tests/unit_tests/migrations/test_agent_drive_skill_metadata_refactor.py:64:13
 ERROR TypedDict `TenantCustomConfigDict` does not have key `feature1` [bad-typed-dict-key]
    --> tests/unit_tests/models/test_account_models.py:594:23
 ERROR TypedDict `TenantCustomConfigDict` does not have key `feature2` [bad-typed-dict-key]
    --> tests/unit_tests/models/test_account_models.py:595:23
 ERROR Argument `dict[str, bool | str]` is not assignable to parameter `value` with type `TenantCustomConfigDict` in function `models.account.Tenant.custom_config_dict` [bad-argument-type]
    --> tests/unit_tests/models/test_account_models.py:616:37
-ERROR Argument `dict[str, bool]` is not assignable to parameter `annotation_reply` with type `AnnotationReplyDisabledConfig | AnnotationReplyEnabledConfig | None` in function `models.model.AppModelConfig.to_dict` [bad-argument-type]
-   --> tests/unit_tests/models/test_app_models.py:357:54
 ERROR Class member `FooModel.id` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
  --> tests/unit_tests/models/test_base.py:6:14
 ERROR `None` is not subscriptable [unsupported-operation]
@@ -6478,40 +6421,42 @@
   --> tests/unit_tests/repositories/test_sqlalchemy_api_workflow_run_repository.py:55:9
 ERROR Argument `list[SimpleNamespace]` is not assignable to parameter `recipients` with type `Sequence[HumanInputFormRecipient]` in function `repositories.sqlalchemy_api_workflow_run_repository._build_human_input_required_reason` [bad-argument-type]
   --> tests/unit_tests/repositories/test_sqlalchemy_api_workflow_run_repository.py:56:9
-ERROR Object of class `object` has no attribute `prompt` [missing-attribute]
-   --> tests/unit_tests/services/agent/test_agent_services.py:591:12
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `scoped_session[Unknown]` in function `services.app_service.AppService._build_app_list_filters` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:1367:61
+    --> tests/unit_tests/services/agent/test_agent_services.py:1138:61
 ERROR Object of class `object` has no attribute `name` [missing-attribute]
-    --> tests/unit_tests/services/agent/test_agent_services.py:1841:16
+    --> tests/unit_tests/services/agent/test_agent_services.py:1530:16
 ERROR Object of class `object` has no attribute `mode` [missing-attribute]
-    --> tests/unit_tests/services/agent/test_agent_services.py:1842:16
+    --> tests/unit_tests/services/agent/test_agent_services.py:1531:16
 ERROR Object of class `object` has no attribute `agent_role` [missing-attribute]
-    --> tests/unit_tests/services/agent/test_agent_services.py:1843:16
-ERROR Object of class `object` has no attribute `agent_role` [missing-attribute]
-    --> tests/unit_tests/services/agent/test_agent_services.py:1919:16
+    --> tests/unit_tests/services/agent/test_agent_services.py:1532:16
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.project_draft_bindings_to_graph` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2123:21
+    --> tests/unit_tests/services/agent/test_agent_services.py:1807:21
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_roster_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2182:21
+    --> tests/unit_tests/services/agent/test_agent_services.py:1866:21
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2251:21
+    --> tests/unit_tests/services/agent/test_agent_services.py:1935:21
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2306:25
+    --> tests/unit_tests/services/agent/test_agent_services.py:1990:25
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2338:25
+    --> tests/unit_tests/services/agent/test_agent_services.py:2022:25
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2370:25
+    --> tests/unit_tests/services/agent/test_agent_services.py:2054:25
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2416:25
+    --> tests/unit_tests/services/agent/test_agent_services.py:2100:25
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_roster_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2476:21
+    --> tests/unit_tests/services/agent/test_agent_services.py:2160:21
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_roster_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2546:21
+    --> tests/unit_tests/services/agent/test_agent_services.py:2230:21
 ERROR Argument `FakeSession` is not assignable to parameter `session` with type `Session` in function `services.agent.workflow_publish_service.WorkflowAgentPublishService.sync_roster_agent_bindings_for_draft` [bad-argument-type]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2579:21
-ERROR Cannot set item in `dict[str, str]` [unsupported-operation]
-    --> tests/unit_tests/services/agent/test_agent_services.py:2825:31
+    --> tests/unit_tests/services/agent/test_agent_services.py:2263:21
+ERROR Object of class `object` has no attribute `skills_files` [missing-attribute]
+    --> tests/unit_tests/services/agent/test_agent_services.py:2475:37
+ERROR Object of class `object` has no attribute `skills_files` [missing-attribute]
+    --> tests/unit_tests/services/agent/test_agent_services.py:2512:34
+ERROR Object of class `object` has no attribute `skills_files` [missing-attribute]
+    --> tests/unit_tests/services/agent/test_agent_services.py:2536:34
+ERROR Object of class `object` has no attribute `skills_files` [missing-attribute]
+    --> tests/unit_tests/services/agent/test_agent_services.py:2537:12
 ERROR Object of class `NoneType` has no attribute `workflow_prompt` [missing-attribute]
    --> tests/unit_tests/services/agent/test_composer_mention_validation.py:113:5
 ERROR Class member `ConcreteApiKeyAuth.validate_credentials` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
@@ -6593,43 +6538,43 @@
 ERROR Argument `None` is not assignable to parameter `response` with type `Response` in function `httpx._exceptions.HTTPStatusError.__init__` [bad-argument-type]
   --> tests/unit_tests/services/enterprise/test_plugin_manager_service.py:61:26
 ERROR Cannot index into `list[Unknown]` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:445:20
+   --> tests/unit_tests/services/hit_service.py:431:20
 ERROR Cannot index into `object` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:445:20
+   --> tests/unit_tests/services/hit_service.py:431:20
 ERROR Argument `dict[str, str] | list[Unknown] | object` is not assignable to parameter `obj` with type `Sized` in function `len` [bad-argument-type]
-   --> tests/unit_tests/services/hit_service.py:446:24
+   --> tests/unit_tests/services/hit_service.py:432:24
 ERROR Cannot index into `object` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:447:20
+   --> tests/unit_tests/services/hit_service.py:433:20
 ERROR Cannot index into `str` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:447:20
+   --> tests/unit_tests/services/hit_service.py:433:20
 ERROR Cannot index into `dict[str, str]` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:447:38
+   --> tests/unit_tests/services/hit_service.py:433:38
 ERROR Cannot index into `object` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:448:20
+   --> tests/unit_tests/services/hit_service.py:434:20
 ERROR Cannot index into `str` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:448:20
+   --> tests/unit_tests/services/hit_service.py:434:20
 ERROR Cannot index into `dict[str, str]` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:448:38
+   --> tests/unit_tests/services/hit_service.py:434:38
 ERROR Cannot index into `object` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:449:20
+   --> tests/unit_tests/services/hit_service.py:435:20
 ERROR Cannot index into `str` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:449:20
+   --> tests/unit_tests/services/hit_service.py:435:20
 ERROR Cannot index into `dict[str, str]` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:449:38
+   --> tests/unit_tests/services/hit_service.py:435:38
 ERROR Cannot index into `list[Unknown]` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:476:16
+   --> tests/unit_tests/services/hit_service.py:462:16
 ERROR Cannot index into `object` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:476:16
+   --> tests/unit_tests/services/hit_service.py:462:16
 ERROR Cannot index into `list[Unknown]` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:511:20
+   --> tests/unit_tests/services/hit_service.py:497:20
 ERROR Cannot index into `object` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:511:20
+   --> tests/unit_tests/services/hit_service.py:497:20
 ERROR Argument `dict[str, str] | list[Unknown] | object` is not assignable to parameter `obj` with type `Sized` in function `len` [bad-argument-type]
-   --> tests/unit_tests/services/hit_service.py:512:24
+   --> tests/unit_tests/services/hit_service.py:498:24
 ERROR Cannot index into `list[Unknown]` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:545:20
+   --> tests/unit_tests/services/hit_service.py:531:20
 ERROR Cannot index into `object` [bad-index]
-   --> tests/unit_tests/services/hit_service.py:545:20
+   --> tests/unit_tests/services/hit_service.py:531:20
 ERROR `in` is not supported between `Literal['license_required']` and `None` [not-iterable]
    --> tests/unit_tests/services/openapi/test_mint_policy.py:109:16
 ERROR Object of class `Marketplace` has no attribute `repo`
@@ -6809,7 +6754,7 @@
 ERROR Object of class `FromClause` has no attribute `drop` [missing-attribute]
   --> tests/unit_tests/services/test_agent_drive_service.py:74:5
 ERROR Argument `Literal['created_at']` is not assignable to parameter `k` with type `Never` in function `_typeshed._type_checker_internals.TypedDictFallback.pop` [bad-argument-type]
-   --> tests/unit_tests/services/test_agent_drive_service.py:745:32
+   --> tests/unit_tests/services/test_agent_drive_service.py:557:32
 ERROR Argument `dict[str, str]` is not assignable to parameter `args` with type `InsertAnnotationArgs` in function `services.annotation_service.AppAnnotationService.insert_app_annotation_directly` [bad-argument-type]
    --> tests/unit_tests/services/test_annotation_service.py:492:69
 ERROR TypedDict `AnnotationSettingDisabledDict` does not have key `embedding_model` [bad-typed-dict-key]
@@ -6820,7 +6765,7 @@
    --> tests/unit_tests/services/test_app_generate_service.py:532:17
 ERROR Argument `_FakeStreams` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.streams_channel.StreamsBroadcastChannel.__init__` [bad-argument-type]
   --> tests/unit_tests/services/test_app_generate_service_streaming_integration.py:96:36
-ERROR Argument `_FakeRedisClient` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.pubsub_channel.BroadcastChannel.__init__` [bad-argument-type]
+ERROR Argument `_FakeRedisClient` is not assignable to parameter `redis_client` with type `Redis[Unknown] | RedisCluster[Unknown]` in function `libs.broadcast_channel.redis.channel.BroadcastChannel.__init__` [bad-argument-type]
    --> tests/unit_tests/services/test_app_generate_service_streaming_integration.py:116:34
 ERROR Argument `None` is not assignable to parameter `orig` with type `BaseException` in function `sqlalchemy.exc.DBAPIError.__init__` [bad-argument-type]
    --> tests/unit_tests/services/test_app_service.py:359:84
@@ -6860,14 +6805,6 @@
   --> tests/unit_tests/services/test_credential_permission_service.py:80:18
 ERROR Argument `SimpleNamespace` is not assignable to parameter `user` with type `Account` in function `services.credential_permission_service.CredentialPermissionService.apply_visibility_filter` [bad-argument-type]
   --> tests/unit_tests/services/test_credential_permission_service.py:97:18
-ERROR Object of class `FromClause` has no attribute `create` [missing-attribute]
-  --> tests/unit_tests/services/test_credit_pool_service.py:24:5
-ERROR Object of class `FromClause` has no attribute `insert` [missing-attribute]
-  --> tests/unit_tests/services/test_credit_pool_service.py:29:13
-ERROR Object of class `FromClause` has no attribute `create` [missing-attribute]
-  --> tests/unit_tests/services/test_credit_pool_service.py:94:5
-ERROR Object of class `FromClause` has no attribute `create` [missing-attribute]
-   --> tests/unit_tests/services/test_credit_pool_service.py:146:5
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]
    --> tests/unit_tests/services/test_dataset_service_dataset.py:329:93
 ERROR Argument `SimpleNamespace` is not assignable to parameter `account` with type `Account` in function `services.dataset_service.DatasetService.create_empty_dataset` [bad-argument-type]

@github-actions

github-actions Bot commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Pyrefly Type Coverage

Metric Base PR Delta
Type coverage 50.90% 50.84% -0.06%
Strict coverage 50.41% 50.35% -0.06%
Typed symbols 30,156 29,972 -184
Untyped symbols 29,373 29,264 -109
Modules 2927 2915 -12

@Snakinya Snakinya changed the title security: fix SSRF bypass via raw httpx.get in API tool schema fetch fix: SSRF bypass via raw httpx.get in API tool schema fetch Jun 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@laipz8200 laipz8200 Awaiting requested review from laipz8200 laipz8200 is a code owner
@QuantumGhost QuantumGhost Awaiting requested review from QuantumGhost QuantumGhost is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

size:XS This PR changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Snakinya