AGENTS.md

1# API Agent Guide
2 
3Read surrounding module, class, and function docstrings plus non-obvious comments before changing backend behavior. They are local contracts; update them only when their owned behavior changes, and keep them aligned with the current code.
4 
5## Commands
6 
7Run backend checks from the repository root:
8 
9- Format and lint: `make lint`
10- Type check: `make type-check`
11- Unit tests: `make test`
12- Targeted tests: `make test TARGET_TESTS=./api/tests/<path>`
13 
14Run direct Python commands through `uv run --project api`. Docker-backed integration suites are normally CI-owned. Do not start long-running services as part of routine agent work.
15 
16## Architecture And Boundaries
17 
18- Keep transport parsing and serialization in controllers, orchestration in services, and domain policy in `core/` or its domain owner. Keep `libs/` business-agnostic and reuse existing owners before adding abstractions.
19- Before changing controller schemas, generated API contracts, or `SystemFeatureModel`, read `controllers/API_SCHEMA_GUIDE.md`. Treat `/system-features` as a minimal unauthenticated bootstrap allowlist, not a general configuration registry.
20- Scope tenant-owned reads and writes by the complete owner chain, and propagate `tenant_id` across every affected layer. Reconstruct trusted internal references from validated database state after payload or async boundaries.
21- Keep write transactions explicit and bounded. Do not perform external I/O inside an open transaction unless a documented consistency contract requires it.
22- Read configuration through `configs.dify_config`, access storage through `extensions.ext_storage.storage`, and route outbound HTTP through the existing SSRF-safe owner in `core.helper.ssrf_proxy`.
23- Use Pydantic v2 for request and response models. Reuse domain-specific exceptions and translate them at the controller boundary.
24- Use existing Celery task and queue owners for asynchronous work; do not route unrelated jobs through workflow-specific services.
25- Celery tasks that may be retried or redelivered must keep side effects idempotent and log affected resource identifiers.
26